WHO: Beware of malicious emails appearing to be from WHO concerning coronavirus

In the frenzy of the coronavirus outbreak, the World Health Organization (WHO) alerts of cyber security criminals who send malicious emails (phishing) appearing to be from WHO, trying to take advantage of the stuation.

Specifically, WHO alerts that criminals are disguising themselves as WHO to steal money or sensitive information.  If you are contacted by a person or organization that appears to be from WHO, verify their authenticity before responding.

Moreover, the Organization informs that they will:

1. never ask you to login to view safety information
2. never email attachments you didn’t ask for
3. never ask you to visit a link outside of www.who.int
4. never charge money to apply for a job, register for a conference, or reserve a hotel
5. never conduct lotteries or offer prizes, grants, certificates or funding through email
6. never ask you to donate directly to emergency response plans or funding appeals.

Beware that criminals use email, websites, phone calls, text messages, and even fax messages for their scams … You can verify if communication is legit by contacting WHO directly.

The phishing emails allegedly sent by WHO ask for sensensitive information, such as usernames or passwords; ask you to click a malicious link; open a malicious attachment.

In order to prevent phishing emails, it is important to:

1. Verify the sender by checking their email address.
2. Make sure the sender has an email address such as ‘[email protected]’ If there is anything other than ‘who.int’ after the ‘@’ symbol, this sender is not from WHO.
3. WHO does not send email from addresses ending in ‘@who.com’ , ‘@who.org’ or ‘@who-safety.org’ for example.
4. Check the link before you click.
5. Make sure the link starts with ‘https://www.who.int’.  Better still, navigate to the WHO website directly, by typing ‘https://www.who.int’ into your browser.
6. Be careful when providing personal information.
7. Always consider why someone wants your information and if it is appropriate. There is no reason someone would need your username & password to access public information.
8. Do not rush or feel under pressure.

WHO advises that

If you gave sensitive information, don’t panic. If you see a scam, report it. If you see a scam, tell us about it.